f5vpn-ng

MEDIUM

maintainer zrhoffman 16 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a prebuilt .deb from a non-whitelisted but project-plausibly-owned host (cdn.f5.com via vpn.f5networks.net), which is unverifiable due to a SKIP'd checksum, and grants setuid privileges to a binary, creating a supply-chain risk if the binary were swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 'license.html::https://cdn.f5.com/product/apm/apps/eula.html')
PKGBUILD:11 source_aarch64=("linux_${_pkgname}-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_${_pkgname}.aarch64.deb")

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:40 chmod u+s "${srcdir}/usr/share/${pkgname}/svpn"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a prebuilt .deb from a non-whitelisted but project-plausibly-owned host (cdn.f5.com via vpn.f5networks.net), which is unverifiable due to a SKIP'd checksum, and grants setuid privileges to a binary, creating a supply-chain risk if the binary were swapped.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Tess Hoffman <tess@zrhoffman.net>
    
      2_pkgname=f5vpn
    
      3pkgname=${_pkgname}-ng
    
      4pkgver=7272.0.0.2
    
      5pkgrel=2
    
      6pkgdesc='VPN client using the Point-to-Point Protocol to connect to F5Networks BIG-IP APM'
    
      7arch=(aarch64 x86_64)
    
      8mirror=vpn.f5networks.net
    
      9source=('com.f5.f5vpn.service' 'desktop-file-dbus.patch'
    
      10  'license.html::https://cdn.f5.com/product/apm/apps/eula.html')
    
      11source_aarch64=("linux_${_pkgname}-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_${_pkgname}.aarch64.deb")
    
      12source_x86_64=("linux_${_pkgname}-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_${_pkgname}.x86_64.deb")
    
      13sha256sums=('0c26681df93149e4339bc2de9aaf92ef4ed4cb926b8e127da72113d02c0923e5'
    
      14            'c71a54a47cae863a095d03cee6b1b97c4fee49f799927abd13f44bd2374988bf'
    
      15            'SKIP')
    
      16sha256sums_aarch64=('32c1ad9ac210b0642ddf2fba5f047372183135bd821a46083bb78b0ba864fefc')
    
      17sha256sums_x86_64=('53c6fc43643200b90aac3d4a0b21e163b6e235d11b51bce1695aec083cf79059')
    
      18b2sums=('b2b3e60a956a4d55e12695d3a034832af321c57a3da6a907600062c723d8eb44b53473effb8346a3aef9e3423378e74e28b3f1d9ea643d19b4d7ebc4034880a6'
    
      19        '62cac1949c36ca2d6f74f72d83e953d9cc95d7cee60acb3f03afcdce71b00e10e3e22613c206858e94a1a91076917cb28d9b2a75133120a344a93fc4a6c6cefc'
    
      20        'SKIP')
    
      21b2sums_aarch64=('0d80c59208284c1905564391ba3ac48ba1875904f6cb512a6eed12ad0154a528e669165e92afc7dfb06be8761014c6597d73195bc4bd41df7b21158f6780d7b6')
    
      22b2sums_x86_64=('6ca40bbc82fd12fef75417cfec457363defbcb6ac2077cadc39e188cfe566a3a713b4c79738fe8dcd5b76d6fdb577abebbe458bf7e9e5671e2d08e5e6e9465fc')
    
      23depends=(curl gtk3 openssl icu libxml2-legacy webkit2gtk-4.1)
    
      24optdepends=(
    
      25  'xorg-xwayland: wayland support'
    
      26)
    
      27provides=("${pkgname}")
    
      28conflicts=("${_pkgname}")
    
      29url='https://techdocs.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-edge-client-7-2-7-2.html'
    
      30license=('commercial')
    
      31
    
      32pkgver() {
    
      33  tar -xf data.tar.xz
    
      34  grep -oEm1 --text '[0-9]+(\.[0-9]+){3}' "usr/share/${pkgname}/svpn"
    
      35}
    
      36
    
      37package() {
    
      38  # f5vpn-ng should not be run as root, but it calls svpn which must be privileged to run ip commands
    
      39  # TODO: Make a dedicated f5vpn service account own and run svpn.
    
      40  chmod u+s "${srcdir}/usr/share/${pkgname}/svpn"
    
      41
    
      42  (
    
      43    cd "${srcdir}/usr/share/applications"
    
      44    patch -i "${srcdir}/desktop-file-dbus.patch"
    
      45  )
    
      46  install -Dm644 "com.f5.f5vpn.service" "${pkgdir}/usr/lib/systemd/user/com.f5.${_pkgname}.service"
    
      47  install -Dm644 'license.html' "${pkgdir}/usr/share/licenses/${_pkgname}/license.html"
    
      48  install -dm755 "${pkgdir}/usr/local/lib/F5Networks/SSLVPN/var/run" # For svpn.pid
    
      49
    
      50  cp -a usr "${pkgdir}"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-09-02 00:02
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,8 +1,8 @@
-# Maintainer: Zach Hoffman <zach@zrhoffman.net>
+# Maintainer: Tess Hoffman <tess@zrhoffman.net>
 _pkgname=f5vpn
 pkgname=${_pkgname}-ng
-pkgver=7271.0.0.4
-pkgrel=4
+pkgver=7272.0.0.2
+pkgrel=2
 pkgdesc='VPN client using the Point-to-Point Protocol to connect to F5Networks BIG-IP APM'
 arch=(aarch64 x86_64)
 mirror=vpn.f5networks.net
@@ -13,20 +13,20 @@
 sha256sums=('0c26681df93149e4339bc2de9aaf92ef4ed4cb926b8e127da72113d02c0923e5'
             'c71a54a47cae863a095d03cee6b1b97c4fee49f799927abd13f44bd2374988bf'
             'SKIP')
-sha256sums_aarch64=('4ad1008f04119975b169963960511174660403f63897be34f91abc4333418915')
-sha256sums_x86_64=('04f8c670fabfe4d125849832973c3441d741ec31b1a325d799b3e702964988c0')
+sha256sums_aarch64=('32c1ad9ac210b0642ddf2fba5f047372183135bd821a46083bb78b0ba864fefc')
+sha256sums_x86_64=('53c6fc43643200b90aac3d4a0b21e163b6e235d11b51bce1695aec083cf79059')
 b2sums=('b2b3e60a956a4d55e12695d3a034832af321c57a3da6a907600062c723d8eb44b53473effb8346a3aef9e3423378e74e28b3f1d9ea643d19b4d7ebc4034880a6'
         '62cac1949c36ca2d6f74f72d83e953d9cc95d7cee60acb3f03afcdce71b00e10e3e22613c206858e94a1a91076917cb28d9b2a75133120a344a93fc4a6c6cefc'
         'SKIP')
-b2sums_aarch64=('48036a2df2c810bdbbbc3ab686da4f0ba1e4bb2c675fa6b0a15c848b8a59353d46ee8a6ea53fff2573961c31207efc732f5fab44b1e23106137b9708d89d9a24')
-b2sums_x86_64=('f8dac5cd7c42aeee508483041400392904e6a695bb8aca267c507c399240b0ea36764de05e591de7ad39024d01be80032fc8ae33c6d5416bd07fc2cab097b911')
-depends=(curl gtk3 openssl icu webkit2gtk-4.1)
+b2sums_aarch64=('0d80c59208284c1905564391ba3ac48ba1875904f6cb512a6eed12ad0154a528e669165e92afc7dfb06be8761014c6597d73195bc4bd41df7b21158f6780d7b6')
+b2sums_x86_64=('6ca40bbc82fd12fef75417cfec457363defbcb6ac2077cadc39e188cfe566a3a713b4c79738fe8dcd5b76d6fdb577abebbe458bf7e9e5671e2d08e5e6e9465fc')
+depends=(curl gtk3 openssl icu libxml2-legacy webkit2gtk-4.1)
 optdepends=(
   'xorg-xwayland: wayland support'
 )
 provides=("${pkgname}")
 conflicts=("${_pkgname}")
-url='https://techdocs.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-edge-client-7-2-7-1.html'
+url='https://techdocs.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-edge-client-7-2-7-2.html'
 license=('commercial')
 
 pkgver() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 00:18:08	Medium	3
2026-09-07 00:30:15	Medium	3
2026-09-06 00:17:06	Medium	3
2026-09-05 00:16:27	Medium	3
2026-09-04 00:03:13	Medium	3
2026-09-03 00:15:47	Medium	3
2026-09-02 09:50:35	Medium	3
2026-09-02 00:02:31	Medium	3
2026-09-01 00:11:19	Medium	3
2026-08-31 00:19:57	Medium	3
2026-08-30 00:04:14	Medium	3